The Security Catalyst» Podcast

Into the Breach – Audio Series – Chapter 5 (The Strategy to Protect Information)

Michael Santarcangelo — Tue, 01 Dec 2009 21:23:18 +0000

Welcome to the continuation of the Into the Breach: Protect Your Business by Managing People, Information and Risk audio series. (Click this link) to learn more about this how this book solves today’s challenges and pick up a complete copy.

This series, underwritten by Configuresoft, now part of EMC, is the full and unabridged audio version of Into the Breach, written by Michael Santarcangelo and read by the author. Join us for a new chapter released on the first Tuesday of each month (there are 13 chapters total).

What you’ll find in episode 6, Into the Breach: Chapter 5 (The Strategy to Protect Information)

Chapter 5 is the introduction to Part II of Into the Breach — where the focus shifts to looking at what needs to be done. I outline a powerful, yet simple, approach dubbed “The Strategy to Protect Information.”

Key is the focus on information, not data, and the three steps that any organization must follow in order to be effective. The balance of Part II explains how – but just learning and understanding the three part strategy is transformative.

After listening to this chapter, you will know the strategy and be able to apply it to your current challenge — small and tactical or larger and organizational.

Put the power of Into the Breach to work for you…

After listening to this segment of Into the Breach, keep the energy going and support the shift in thinking and inspire behavior change by

Engage with Michael on twitter (http://twitter.com/catalyst)
Subscribe to The Security Catalyst podcast & blog to get more insights; ask a question and get an answer!
Check out Awareness that Works™ – Michael Santarcangelo’s program to guide smart investment in people, with guaranteed results (this program pays for itself).

Into the Breach – Audio Series – The Introduction

Michael Santarcangelo — Sun, 05 Jul 2009 18:43:04 +0000

Welcome to the audio series of Into the Breach: Protect Your Business by Managing People, Information and Risk (click this link to learn more about this book). This series, underwritten by Configuresoft, now part of EMC, is the full and unabridged audio version of Into the Breach, written by Michael Santarcangelo and read by the author. Join us for a new chapter released on the last Tuesday of each month (there are 13 chapters total).

What you’ll find in this segment

The Introduction explores the nature of the challenge faced by organizations around the world. As we prepare for the journey “Into the Breach”, it is revealed that breaches are only symptoms, and the real challenge is described as a human paradox. Setting the stage for a shift in thinking necessary to get results, three common myths are exposed and addressed. A powerful strategy to protect information is shared, and the clarion call to engage, empower and enable people is sounded.

Put the power of Into the Breach to work for you…

After listening to this segment of Into the Breach, keep the energy going and support the shift in thinking and inspire behavior change by

Engage with Michael on twitter (http://twitter.com/catalyst)
Subscribe to The Security Catalyst podcast & blog to get more insights; ask a question and get an answer!
Check out Awareness that Works™ – Michael Santarcangelo’s program to guide smart investment in people, with guaranteed results (this program pays for itself).

netcast for this week: I was the (surprise) guest host on the Netsec Podcast

Michael Santarcangelo — Thu, 03 Jul 2008 20:02:45 +0000

One of the true benefits of sharing thoughts through spoken and written word is the ability to meet quality people. I thrive on conversation – especially discourse that leads to new understanding. I am a firm believer that through purposeful conversation, honest intentions and open minds we can solve a lot of challenges we face.

So when Martin McKeay and I were “chatting” online Tuesday night, he popped in with “Hey – no pressure, but do you want to cohost tonight?” It took about a minute to decide. He shared some links to stories to talk about and I took 30 minutes to read them and write down some ideas – and then boom – we recorded.

I really enjoyed the conversation and was really amped at the end. It took me a while to get ready for bed – my mind was still engaged. I hope you have a similar experience when listening!

Find the show notes here: http://netsecpodcast.com/?p=48

And the direct link to the program here: http://media.libsyn.com/media/mckeay/nsp-070108-ep110.mp3

(PS: I hope you still chose to listen to the programming on The Security Catalyst; however, somewhere in the feedchange, we seem to have confused iTunes. If it doesn’t look like we have new shows – you may want to unsubscribe and resubscribe.)

Security Catalyst Show – Pop Culture Security (debut): Night at the Museum

Michael Santarcangelo — Wed, 28 May 2008 12:37:59 +0000

Welcome to the debut of the Pop Culture Security program – a monthly installment of the Security Catalyst Show. Please also welcome James Costello – the man with the idea for this program and my cohost on this effort. This program explores and explains how to use pop culture to communicate security concepts to those around you. We explain by doing, and respond to your challenges.

This podcast is based, to a large extent, on the work James did in preparing for and delivering a peer to peer session at the RSA conference this year. While sitting at Mel’s the morning of his presentation, we enjoyed a conversation about the topic that kept on going, and immediately decided the best way to extend the conversation and build on his efforts was to produce a monthly program.

For our first piece of Pop Culture to use as a reference point to better explain security, we selected Night at the Museum – a comedy with Ben Stiller that is currently (or was) running on Home Box Office (HBO).

Movie at IMDB (including synopsis): http://www.imdb.com/title/tt0477347/

Movie Trailer: http://www.imdb.com/video/screenplay/vi2459500825/

This movie held many lessons for those responsible for security in addition to providing some excellent examples for us to anchor our points to. We will work to keep the program short, informative and useful – especially if you are interested in building a security awareness training program that works!

To participate in the monthly challenge:

call 206-350-8346 and leave us a message with your challenge
email popculturesecurity &at& securitycatalyst dot com

PS: I recently purchased a snowball microphone in an effort to streamline my audio programs and preserve quality. So far, I am disappointed with the quality of the unit – and feel that my sound is hollow and tinny; as such, I’ll be exploring how to restore the sound quality I appreciate in the coming days. The challenge is capturing sound in a way that works with Skype for many of this interviews, but is still portable. If you have experiences, ideas and suggestions for something functional, portable and reliable – shoot me a note. In the meantime, enjoy the programs. More to come next week, with an “Author Interview.”

TSC May 21 2008 | The Right Way to Address the Debian OpenSSL Vulnerability

Michael Santarcangelo — Wed, 21 May 2008 16:21:48 +0000

It was disclosed last week that a vulnerability in the OpenSSL packages used by debian systems contained a flaw where random numbers were not actually random, paving the way for another attack vector.

Plenty of specific details and analysis can be found in different places, including:

http://wiki.debian.org/SSLkeys

http://www.us-cert.gov/cas/techalerts/TA08-137A.html

http://www.kb.cert.org/vuls/id/925211

http://secunia.com/advisories/30220/

For many, this signals the fire-drill of reaction and patching — just in time for a big holiday weekend (aka the “start of summer”) here in the United States.

Just days before this was announced, I was introduced to Venafi (as a direct result of my press pass at RSA). During the conversation, I realized they really own the niche of Systems Management for Encryption. As we shared a lively and informative conversation, I was reminded that SSL is not just something we stick on web servers; it goes deeper and wider in many enterprises today. As soon as you have to manage many of these encrypted connections, the process gains some complication – and is ripe for error. Step in Venafi.

When the debian vulnerability was announced, I immediately asked if Venafi would be willing to share some insights about how organizations should be handling this issue. This is bigger than patching (remember code red?) – and I wanted a discussion that provided insights into how to manage this in a way that brought immediate results but also good long-term gain.

During this program, Paul (from Venafi) and I start by exploring how to engage business users in the conversation. We progress to tactical and strategic ways to address this challenge while realizing this is an opportunity to make some improvements that bring better future results.

It comes from planning and following a process informed by experience – and we’ll share the insights with you in 30 minutes or less!

In the wrap-up, I suggest following the approach of plan-do-review, outlined in this podcast: http://www.securitycatalyst.com/blog/2008/01/31/the-security-catalyst-show-plan-do-review-your-way-to-success/

Tune in next week for the debut of the Pop Culture Security podcast – your monthly “how-to” for Security Awareness Training.

Introduction a brave new program – Driving the Digital Revolution

Michael Santarcangelo — Wed, 13 Feb 2008 22:28:19 +0000

I am excited to introduce to you a new program that I host and produce for Cornell University called “Driving the Digital Revolution.”

Driving the Digital Revolution is a simple, but powerful, way to consider the changes taking place around us every day. The digital revolution has led cultures from poverty, literally changed the face of global business, local business and even impacted on the family structure. Without question, the digital revolution both counts on and plays an active role in shaping how people protect information.

Cornell takes its role in driving the digital revolution seriously. In both education and research, emphasis is placed not only on the field of study, but in how that subject is being transformed by advances in computing and information resources. It realizes that as ideas and technologies are advanced, we have an obligation to not only consider the consequences, but to study and anticipate the unintended consequences.

I am sharing this with you for two reasons:

(1) I am passionate about this series and the opportunity to work with other experts to dig deeper and uncover important concepts that are driving the digital revolution; their words have a lasting impact on me, and I believe they will on you, too.

(2) We are at a place in our industry when we need change. We need to grab on to a vision of hope and drive change. Studying how Cornell participates in driving the digital revolution is a blueprint for our success.

So sit back, plug in and consider the words — and passion — of Dean Constable and how they apply to what you do. Working together, we can change the way people protect information.

There are three ways to listen and subscribe (so you get every episode)
1. Each episode incorporates the ability to listen on the website! Simply point your browser to http://www.cis.cornell.edu/alumniblog/ and press play
2. You can download this episode directly: http://www.cis.cornell.edu/alumniblog/podcast/cornell-ddr-01.mp3
3. If you prefer to use and subscribe using RSS, here is the feed: http://www.cis.cornell.edu/alumniblog/feed/

The Security Catalyst Show | Plan – Do – Review your way to success

Michael Santarcangelo — Thu, 31 Jan 2008 05:56:10 +0000

Into the Breach is really taking shape – but I have been eager to get back behind the microphone and share the ideas and concepts I have been working on. You witnessed my transition to The Security Catalyst last year, and with it, my focus on changing the way people protect information.

In this podcast, I share a simple and powerful concept that can be applied to anything you do: PLAN – DO – REVIEW

I first learned about PLAN – DO – REVIEW a few years back when it was time to learn about nursery schools, and one of the schools followed the HIGH/SCOPE method. Curious, I went to explore and learn more. Since then, I have tested and adapted the approach for my own use – with excellent results.

Now I share my experience with you.

Here are three links if you would like to learn more:

http://www.highscope.org/

http://en.wikipedia.org/wiki/High/Scope

http://www.perpetualpreschool.com/highscope/highscope_info.htm

The Security Catalyst Podcast: A Conversation with Brian Chess

Michael Santarcangelo — Thu, 29 Nov 2007 00:18:15 +0000

On this program, we share a conversation with Brian Chess, the author of Secure Programming with Static Analysis – a conversation that is a must listen for business leaders, security professionals and developers if you want to learn how to engage your teams to better protect information.

Brian takes an approach with secure programming that is similar to the approach I follow when assessing and implementing awareness and training programs. So whether you are a developer or not, you will change the way you protect information by listening to Brian!

What I took away from my conversation with Brian
After reflecting on our conversation (I explain more during the podcast), here are the top five points I took away:

1. Introspection is important when looking to protect information. To me, this also means we have to stop blaming and looking to assign blame. We can look within, take (and encourage) responsibility and find solutions.

2. Trust is paramount. We have to find ways to establish and maintain trust, offline and online.

3. We need to develop processes and tools to support our experts in a way that naturally engages them and encourages their participation in information protection.

4. New processes, new learning and new tools require an initial investment (time, money and resources) that may sometimes seem sizeable – but the savings are realized rapidly and bring long-term positive benefits.

5. In security, we need to stop griping and learn to be good coming from behind. It’s okay, and we can do it.

What did you take away from this conversation? Send me an email: securitycatalyst@gmail.com, or better yet – join us in the security catalyst community – www.securitycatalyst.org and share your insights with others.

Information and Links

Brian Chess, Ph.D., Founder & Chief Scientist
http://extra.fortifysoftware.com/blog/bloggers.html

Dr. Chess’s research focuses on methods for creating secure systems. He received his Ph.D. from the University of California at Santa Cruz, where he applied his background in integrated circuit test and verification to the problem of identifying security errors in software. In addition to authoring numerous patents and technical papers, Dr. Chess has more than ten years of experience in the commercial software arena, having led development efforts at Hewlett Packard and NetLedger.

Secure Programming with Static Analysis

http://www.amazon.com/Programming-Analysis-Addison-Wesley-Software-Security/dp/0321424778/ref=sr_1_1?ie=UTF8&s=books&qid=1196292147&sr=8-1

Blogging with Brian Chess

http://extra.fortifysoftware.com/blog/

Serving Your Needs
I thoroughly enjoy researching and producing these podcasts – and looking forward to getting back into a programming schedule with a bit more regularity. I’ve also been impressed with the Talk Shoe service, and considering hosting more podcasts through Talk Shoe so you can listen in live.

Let me know if you would listen live and participate if we made that an option, and who you would like to share a conversation with by sending me a note: securitycatalyst@gmail.comAs always, thanks for the gift you give me by listening. If you liked the program, tell a friend. If not, tell me!

The Security Catalyst Podcast – Why Virtual Teams Fail (and how to avoid it)

Michael Santarcangelo — Sat, 03 Nov 2007 11:19:06 +0000

This podcast explores how and why virtual teams fail, based on new research from a group of graduate students at Johns Hopkins Carey School of Business.

My belief is that in order to protect information, we have to support the individual – and make it easier for them to do their job. By learning more about how virtual teams fail, we can learn how to avoid mistakes and build stronger and more effective collaboration opportunities – where people can do their jobs while taking responsibility for protecting information. By absorbing this research, you may also learn how to work more effectively on your own virtual teams.

After our interview, I share the top five things that I learned about nurturing and protecting virtual teams. I invite you to sit back, listen, learn and contribute. I’m happy to keep the conversation going in the security catalyst community.

Background: Bring new knowledge to the field of work team behavior
A group of five graduate students (Robert Darling, Cari Endicott, Lisa Fratino, Matsuno Inoue, and Ellen Snydman) from the Carey Business School of Johns Hopkins University participating in a team building course under the leadership of Dr. Robert Pernick were charged with bringing new knowledge to the field of teaming.

This group elected to research the world of virtual teaming, and in doing so, found that here is a great body of literature on what makes virtual teams successful, but little written about what causes them to fail or become sub-optimized. The team’s first research effort was to conduct structured interviews with a group of virtual teaming experts.

The experts interviews generally agreed that the success of virtual teams were threatened by:
•    Concerns regarding the ability to protect sensitive information
•    Lack of a single platform that provides all the tools necessary to optimize
•    The struggles of virtual communication
•    Poorly or under-trained users
•    The challenge of building trust without the use of face-to-face communication

Overall, the experts agreed that all of these obstacles can be overcome and unless combined into the “perfect storm” are not likely to cause catastrophic failure. The experts felt very good about the work that is be done virtually and believe that the use of virtual teams will become even more prevalent into today’s global society.

The second phase of research involved the distribution of a short, online survey about virtual work. The results of the survey are still be collected, but at this point there seems to be a great deal of overlap with the findings from the subject matter experts. The podcast you are listening to will explore both elements of the research and will introduce yet another subject matter expert, Stu Snydman, the Manager of Digital Production at the Stanford University Libraries.

This podcast was created and hosted by Michael Santarcangelo and expertly engineered by Steve Witt. Thank, Steve!

Security Catalyst Podcast – The Value of Fundamentals

Michael Santarcangelo — Tue, 17 Jul 2007 05:04:18 +0000

I’m back, baby! I know I’ve been remiss in sharing some ideas and observations – but I’ve been really focused. As I continue to focus on changing how people protect information, I have come to appreciate the value of the fundamentals. I share some insights in this long overdue podcast. Things you will learn by listening to this podcast:

I am a yankees fan
Three lessons I took away from watching professionals and legends
How to have more fun at work

I also share some updates on the Information Protection Assessment Toolkit, make a special offer and update some of my travel plans. It’s nice to be back. We have an SRT coming up, and I have a lot I hope to share… more to come… If you enjoy this, let me know. If not, let me know how I can make your job easier and improve the quality of your podcast experience.

Security Catalyst: Family Security Series Podcast, Episode 2 – Using a Non-Administrative User

Michael Santarcangelo — Fri, 06 Apr 2007 03:43:43 +0000

You are invited to learn how to reduce the effectiveness of attacks and sleep better at night by using a non-administrative user account. In this brief podcast, we explain:
-   why you should be using a non-administrative user account
-   how to determine which type of account you are currently using
-   how to create normal user accounts
-   how to change to a regular user account

Thanks to a dedicated team of professionals, this podcast has been made better. If you see them on the street, give them a big hug. They worked hard (and continue to) to improve our efforts to make a difference:

• Gary Morgan, CISSP
• Alvin Liau, CISSP
• George Viconovic, MCIW/D
• James Costello, Security + SME
• John Biasi
• Peter Clark, CISSP

If you have not yet joined the conversation in the Security Catalyst Community, please do so now: http://community.securitycatalyst.com/forums/index.php

The specific link for this discussion is here: http://community.securitycatalyst.com/forums/index.php/topic,335.0.html
(note: joining the community costs nothing – except your active participation!; we enforce a naming standard of using your full name. It helps us keep the supportive environment positive. We look forward to sharing ideas and learning with you.)

Links and Information Mentioned During the Program

Least Privilege

In computer science and other fields the principle of minimal privilege, also known as the principle of least privilege or just least privilege, requires that in a particular abstraction layer of a computing environment every module (such as a process, a user or a program on the basis of the layer we are considering) must be able to access only such information and resources that are necessary to its legitimate purpose.
Source: Wikipedia: http://en.wikipedia.org/wiki/Principle_of_least_privilege

Determine the current status of a user account

Two basic options in windows XP
Windows XP: Option 1
• Start -> Run -> CMD (bring up a command prompt)
• type ipconfig /renew (this will be in the show notes)
• Limited Users will be given an error that access is denied. Administrators will be allowed to renew their IP address.

Windows XP: Option 2
• Start –> Control Panel
• Launch the User Accounts application

If you are a Limited User you will be presented with the option to Change your picture or to click on Mail or User Accounts. • You are limited to changing your own password
• changing your picture
• or to set up your account to use a .NET Passport.

If you are an Administrator you will be given the option to Change an account, create a new account or change the way users log on or off.

For more ways, join the discussion in the catalyst community forums: http://community.securitycatalyst.com/forums/index.php/topic,335.0.html

Mac OSX
• System Preferences –> Accounts
• Right under the name it tells you the kind of account they have

Create a non-admin account

Mac OSX
• System Preferences –> Accounts
• Check that the lock is unlocked; if not, click it and enter your password
• click on the + sign
• Enter in the information, including a password
• DO NOT check (make sure you leave blank) the box for ‘Allow user to administer this computer’

Windows, pre-vista
• Start -> control panel
• Select ‘User Accounts’
• Select ‘Create a new account’
• Type in the name of the new user account
• Select the ‘Next >’ button
• Select the ‘Limited’ radio button
• select the ‘Create Account’ button

you’re not done! Time to select a good password
(We will go into details on good passwords in the future)
• You will be presented with a ‘User Accounts’ screen, with a ‘Pick a task’ option. Select ‘Change an account’ option
• Select the account you just created
• On the next screen ‘What do you want to change about Child 1′s account?’ select ‘Create a password’
• Then enter a strong password, in the first two boxes, enter a password hint in the Third box. Then press the ‘Create Password’ button’

Support the efforts of The Traveling Catalyst!
RV Tour (our pre-tour warmup for the Security Revival Tour)

• Nashville (April 24 – 25)
• Atlanta (April 26 – May 3 or 4)
• Key West (May 3 or 4 until May • Baltimore/Washington/Northern Virginia (May 10 – May 18)

We’re working now to set up some public sessions of
• Are You Making a Living or a Life?
• Career Compass Coaching
• Speaking About Security

We’re also interested in offering some public keynotes in each of the areas to support the efforts of security professionals. Send me an email if you’re interested (securitycatalyst@gmail.com)

We are in the process of selecting cities for our ”security revival tour” for the second half of 2007. If you would like us to bring our training to your city, send me an email: securitycatalyst@gmail.com

Thanks for listening – now go make your user account changes and be safe out there!

Episode 1 (of 7) – (Teach Your) Family Security Series Security Podcast – Operating System and Application Updates

Michael Santarcangelo — Fri, 02 Mar 2007 21:38:05 +0000

I feel like we’ve been building to this for a while now… Here is the first episode of the Family Security Series podcast. This episode focuses on operating system and application patching. The goal is to explain the basic approach, some configurations and then provide links and details, as available. I invite you to not only listen, but to share this podcast with others – especially those that you think would benefit from it.

We have also decided to include at least monthly programming designed to help consumers; this helps you with your awareness efforts.

I want to thank the advisory committee for their help. This episode is better because of:
- Andrew Hay | Founder and CEO of Koteas Corporation
- Peter Clark
- Alvin Liau, CISSP
- John Biasi

Basic Overview Sites (some of this material will be covered in future episodes)
Microsoft Security Site for Home Users
Apple Security Site (good starting point)

Links for Microsoft (Operating System)
Windows Update

If you need/want an alternative: AutoPatcher

Links for Apple/Mac (Operating System)
Mac OS X: Updating your software
Application Update Links

For Microsoft Applications:
Use System Restore to Undo Changes if Problems Occur
Product updates, free trials, and third-party downloads (there is a button on the right hand side to allow you to check for updates)

Other Updates we mentioned:

Download the latest version of Adobe Reader
Firefox (browser)
Thunderbird (email client)
Real Player

(if you have others – send them to me at securitycatalyst@gmail.com and I will include them in our Family Security Resources Section)

Episode Lineup:
Episode 1: OS and Application Patching
Episode 2: non-admin user
Episode 3: Anti-Virus, Anti-Spyware and other needed protections
Episode 4: Firewalls
Episode 5: Backup
Episode 6: Wireless Securiy Basics
Episode 7: Professionals Best Practices

Come discuss this and other ways to help protect information in the Security Catalyst Community.

If this helped you, please invite two friends to listen.

Our first Security Podcast Q&A with Adam Dodge

Michael Santarcangelo — Mon, 19 Feb 2007 19:17:07 +0000

Welcome to a new programming aspect of the Security Catalyst experience: our Q&A podcast. After recording this weekend, we made the decision to run this today and push the Family Security Series back a few days (the team engaged in advising me has really brought on a lot of value and I am looking forward to getting that program started).

So, what can you expect from this program?
- Our goal is to review questions and answer them monthly
- We will answer questions sent in by readers and listeners, across three basic types:

- career
- consumer
- business

- Depending on each show, we may not cover each segment (or we might be covering one topic across all three). We’ll see how it goes.
- We are also taking the time for each program to research the questions a bit, and then are combining our experience, opinions and research to provide what we hope to be useful and helpful information.
- Each show will list links (which you’ll see below).

Here is our disclaimer
This is our best effort. To really benefit from this experience, we invite you to get engaged in the process:
- if you see something we missed, join us in the discussion forum and chime in
- use our experience as a guide for your own decision making
- if you need more help, join the security catalyst community (note the naming convention of: Firstname.Lastname)

On this Episode (three questions)

1. “I was curious if you are aware of any resources for security study and job-seeking, as I’m entirely self-taught. At this point I scan the logs and read whatever I can on the web and industry rags. I do Windows but prefer linux for its stability – most of my tools are on the linux box. Pisses off my boss to no end Not bad for self-taught, but it’s time for a large pay raise” – Jeff

Links from our answer:
NSA as Centers of Academic Excellence in Information Assurance Education (CAEIAE) http://www.nsa.gov/ia/academia/caeiae.cfm
http://www.cnss.gov/full-index.html

A list of all CAEIAE insitutions and the areas they have certified in is available here http://www.nsa.gov/ia/academia/iacmap.cfm

CISA – www.isaca.org/cisa/
CISM – www.isaca.org/cism/
CISSP – www.isc2.org/
SANS – www.giac.org/certifications/roadmap.php
Norwich – http://www.msia.norwich.edu/insecure/

Join the discussion in the Security Catalyst Community:

http://community.securitycatalyst.com/forums/index.php/topic,95.0.html
and
http://community.securitycatalyst.com/forums/index.php/topic,116.0.html

2. “I’m looking for some topic ideas relating to some awareness initiatives here where I work. I know you’ve been asking for feedback on topics, and I was wondering if you’d share any of your findings.” – Jim

Special Offer: If you send me an email at securitycatalyst@gmail.com – I will work with you to survey your audience and provide the results to you to help you kick-start your awareness program. While I welcome the opportunity to explain some of our research, there are no strings attached. This is what I do for a living, and if it helps get our much needed awareness efforts kick-started, then I’ll contribute this to the industry.

Links:
Come discuss this with us in the forum:
http://community.securitycatalyst.com/forums/index.php/topic,41.0.html

Some other ideas for topics:
NIST 800-69, Guidance for Securing XP Home: http://csrc.nist.gov/itsec/guidance_WinXP_Home.html (** this is what we are using for the first 5 episodes of the FSS Podcast)
CERT Home User Security: http://www.cert.org/homeusers/HomeComputerSecurity/

3. “I have been researching antivirus software for too long and just keep going in circles. I cannot distinguish between different antivirus software vendors because of either their marketing hype, inconsistent reviews, FUD, etc. Is there really a quantifibable difference or is it just opinions? What are your thoughts on this and could you provide an antivirus suggestion? At this moment I am leaning more towards either Zone Alarm Security Suite, or Kerio and NOD32.” – Eric

Links
If you are looking for more information on how specific AV software did in testing, check out
- AV Test (www.av-test.org), independent testing lab in Germany
- CheckVir (www.checkvir.com), independent testing lab in Hungary
- ICSA Labs (www.icsalabs.com), one of the first organizations to start testing the claims of AV vendors, now part of Cybertrust (www.cybertrust.com)

For those adventurous types that are looking to run a few in house tests, here are some resources that might help
- The European Expert Group for IT-Security (www.eicar.org), Look for the “Anti-Malware Testfile” link on the main page

Free AV resources
- AVG Free – http://free.grisoft.com/doc/1
- Avira AntiVir Personal Edition – http://www.free-av.com/antivirus/allinonen.html
- ClamWim – http://www.clamwin.com/
- TrendMirco Free Online Virus Scanner – http://housecall.trendmicro.com/

Subscription AV resources
- CA eTurst Antivirus – http://www3.ca.com/solutions/Product.aspx?ID=156
- Symantec (number of different products for home/small to mid business/enterprise) – http://www.symantec.com/index.htm
- McAfee (same as symantec, differen products for different sectors) – http://www.mcafee.com/us/
- NOD32 – http://www.eset.com/
- Sophos (for businesses) – http://www.sophos.com/

Additional reviews
- AV Test – http://www.av-test.org
- CheckVir – http://www.checkvir.com
- ICSA Labs – http://www.icsalabs.com

Security Catalyst (Security Podcast) Update for February 8 2007

Michael Santarcangelo — Thu, 08 Feb 2007 19:18:56 +0000

I know, I know… all work and no play. I can tell when I’ve been away from podcasting for a few days (okay, weeks) when I start getting polite emails and nudges… well, here is a quick audio update for you.

If you’ve been following this site for a while, you may recall that I took some time at the turn of the year to think and plan how to be more effective in my business, as a blogger and as a podcaster. As a result of that planning (and my quest to regain some harmony in my life), we dedicated the entire month of January, and now some of February to documenting our approach, value and explaining our focus: to create, design and deliver exceptional experiences that help transform how organizations think about and protect information.

As a result, I am excited. I am healthy. And I am ready to get back behind the mic. Of course, I need to make sure that we keep my team healthy, active and busy… but as that is coming more clearly into focus, I’ll have more time to get back to active podcasting.

In this update:
The 5 Steps to protecting your computer
Here are the five basic steps that anyone with a computer should be following
1. Update your operating system and applications
2. Use a non-admin account for general use
3. Install, configure and use anti-virus, anti-spyware and other malware protections
4. Install, configure and use a firewall
5. Backup, backup, backup

Each of the next five episodes will cover each of those steps, exploring the how and why in a way that we can share with technical and non-technical people alike. Then we’ll produce two additional programs to cover basic wireless configuration and some additional tips from the pros.

Our Awareness Experiences and Efforts
In this update, I briefly mentioned that I am focusing on providing two exceptional experiences and a new way to handle security awareness

Speaking about Security
This two-day intensive experience is designed to explore the power of the narrative and teach professionals how to communicate about security concepts more effectively. Currently available as private classes; we are looking into holding some public courses.

Avoiding the Breach
Based on the research and prescription for success from my upcoming book, this two-day experience is an entertaining and proven approach to transforming how technical and non-technical people in your organization think about and protect information. Currently available as private classes; we are looking into holding some public courses.

Security Awareness Transformation
This is an exciting offering where we are combining the power of social media with our proven ability to connect with users with strategies to better protect themselves and their information (as well as yours).

For each of these, I will be sharing key concepts, lessons and strategies over the coming year. I’m interested in taking an approach of sharing the information so we all benefit, and then working with companies that are interested in being supported through their transformation. If you want some information in the meantime, shoot me an email. I’m excited about these areas and always interested to share some energy, passion and insight.

I’m currently looking for five (5) companies to work with me on each of these experiences to help validate some changes and approaches. If you are interested, please contact me and we can talk about some incentives I am currently offering to those interested in making an impact in 2007 – securitycatalyst@gmail.com

My approach to podcasting for 2007
We will share our research, knowledge, insights and work to provide you with insights, information, facts and templates to be more effective. I’ve also already announced some new programming we’re starting this year… but don’t worry, I’ll continue, when possible, to release some shorter podcasts that capture my thinking, my passion and help to get it out.

If you want to help: securitycatalyst@gmail.com

More to come soon…

Security Catalyst Podcast – Preparing for Daylight Savings Time Changes in 2007

Michael Santarcangelo — Fri, 19 Jan 2007 07:06:10 +0000

Did you know about the changes in Daylight Savings Time for 2007? Have you already assessed the plan you and your company will use to reduce friction? For the first Security Catalyst podcast of 2007, I decided to push the (Teach Your) Family Security Series back a week in order to shed some light on the changes that the shift in Daylight Savings Time (DST) will see in 2007.

During this episode, we explore:
The improvements planned for 2007, which include
* More programming and a focus on series (Family Security, Hard Drive Encryption, etc.)
* The change to a more consultative approach — so you can work smarter, not harder
* The introduction of the monthly Security Q&A with Adam Dodge
* The introduction of the monthly Privacy Stratgies with John Sileo
* The launch of the Catalyst Community Forums http://community.securitycatalyst.com/forums/index.php

Note: please come and join us in the forums, but please register using the convention firstname.lastname and include your full name in your signature. Thanks!

Daylight Savings Time 2007

Now takes effect three weeks earlier, on Sunday March 11, 2007
Ends one week later, Sunday November 4, 2007

Some useful links to help you get started in your preparation. More will be maintained in the Catalyst Community Forum Topic (along with my outline for a basic action plan):

Community Forum Topic: http://community.securitycatalyst.com/forums/index.php/topic,32.0.html

Our initial heads up:
http://www.securitycatalyst.com/2006/12/04/dst2007-%e2%80%93-springing-ahead-of-time/ (hat tip to Ron Woerner for being ahead of the curve)

The CISCO briefings on the events in Oz:

Daylight Savings Time Impact on Cisco Security MARS in Australia
http://www.cisco.com/en/US/products/ps6241/products_tech_note09186a0080626184.shtml

Australian 2006 Daylight Saving Impact on Data Center/GSS and Branch Office Application Products
http://www.cisco.com/en/US/products/hw/contnetw/ps4162/products_tech_note09186a0080626ac6.shtml

Vendors (start your search here):
Microsoft: http://www.microsoft.com/windows/timezone/dst2007.mspx

Cisco: http://www.cisco.com/en/US/products/sw/custcosw/ps1973/products_field_notice09186a008076fca2.shtml

SUN (Java Runtime Environment): http://java.sun.com/developer/technicalArticles/Intl/USDST_Faq.html

Oracle: http://blogs.oracle.com/schan/2006/12/26

IBM:
http://www-1.ibm.com/support/docview.wss?rs=2004&context=SSVHZU&dc=D600&uid=swg21248273&loc=en_US&cs=UTF-8&lang=en

If you liked this program, please take a moment to subscribe and invite two friends to subscribe, too. We can all make 2007 a year where we think about and practice security more effectively!

Security Catalyst – December 31, 2006 – In-depth with Punch Scan

Michael Santarcangelo — Sun, 31 Dec 2006 23:06:37 +0000

On this last day of 2006, it seemed fitting to (finally) post the conclusion to the voting security series (it was delayed due to an ear infection and my lack of desire to finalize the recording). Now, from sunny Key West, I wanted to make sure we ended the year strong.

No end of year reflections, but in looking at the lessons learned, I realized that voting security and security in general have a lot more in common that we may realize at first glance. The good news, then, is that in 2007 we can continue to improve the way we practice security… and we may also be able to help improve the way our electronic voting systems work.

When listening to this interview, it may make sense to check out some of the diagrams and pictures from the punch scan website: www.punchscan.org

I really am impressed not only by the solution punch scan proposes, but by the energy and dedication of the punch scan team. I hope this solution is tested in 2007 and starts to gain more momentum. I plan to keep in touch with punch scan and support them as they continue to move forward.

I’m going to ring in the New Year wearing shorts and hanging out on the docks… and then I’ll be using some of the time here to think about and plan for the upcoming year. Expect more programming and more features designed to help you improve the way you explain and practice security in 2007. And expect to see the launch of the catalyst community (to support your efforts) as well as some additional programming, features and a book!

Yup, 2007 promises to be an exciting year for us all!

Thanks for your continued support, ideas, suggestions and passion. Especially your passion.

Security Catalyst 38 | Voting Security Mini-Series Gets Launched – 3 Things I Learned from ‘Hacking Democracy’

Michael Santarcangelo — Thu, 23 Nov 2006 06:35:43 +0000

Now that the elections are over, I figured it was a good time to step up the programming of the podcast by introducing some mini-series. I think mini-series will provide us the opportunity to pick topics that matter and dive a bit deeper. At least, we’re going to give it a try… feedback welcomed.

To kick it off, I figured we could start by looking at the security around electronic voting. Yea, I know, the elections are over. To me, that makes for perfect timing. Less stress right now, and a good time for our profession to think about how we can help to improve the process.

Here are some links as mentioned in the podcast:

Google Video

Hacking Democracy (http://www.hbo.com/docs/programs/hackingdemocracy/?ntrack_para1=leftnav_category7_show1)
HRM! It seems to have been removed from Google Video. Well, it’s still being aired on HBO – so hopefully you will get a chance to see a copy. It’s worth the watch!
Site to See

Securosis (http://www.securosis.com/)
Rich Mogul’s Bio (http://securosis.com/about/)

Voting Stories and Links

E-voting 2006: A touch screen, a missing vote, a mystery in Arkansas (http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005063&source=rss_topic84)

Questions we can help answer? Stories you want me to explore? Cheers or Jeers? send me an email: securitycatalyst@gmail.com.

Security Catalyst 37 – The FBI asks for help… so let’s help!

Michael Santarcangelo — Tue, 31 Oct 2006 03:35:28 +0000

In this episode, we explore how we can effectively partner with the FBI to share information in the form of a CONVERSATION where everyone who participates gains. I lay out three steps that I think we should discuss to improve this process. I look forward to your feedback.

Sites to See

http://www.changethis.com/

Some of the recent manifestos that I have read and enjoyed:

http://www.changethis.com/19.CreativeGeneralist

Actually, there are many on the list, and while reviewing the site again today, I downloaded and printed a few off. Many good things here to read and consider. Heck, we should consider submitting Security 2.0. Anyone want to write with me?
News Articles About the FBI Announcement

Cybercrime High On FBI Priority List; Help Wanted

FBI: Companies Need to Report Cyber Attacks

As you know, I am a strong supporter of the FBI and have suggested three ways that we all need to work together to make a difference.

1- We need to bring together academic, private and public sectors and begin a real dialogue about how to measure the effectiveness of security. We have enough brain power and models available. The time has come to advance real solutions. When we have a better model, we can work to share more information.

2- We need a taxonomy. We need an “open-source” style taxonomy that covers the breadth and depth of knowledge and experiences that we would need to cover. As we launch the community, I hope to advance this. I look forward to your help.

3 -We need a way to mutually share information. I listed out a variety of ways and will be testing one in my local infragard in the coming months. Stay tuned!

Updated Note: The episode doesn’t seem to be including in the feed. I’m trying to figure out why and should have it fixed tonight or tomorrow morning.

Security Round Table – Episode 5 – Security of VoIP in the Enterprise

Michael Santarcangelo — Tue, 03 Oct 2006 03:29:51 +0000

Join us for our fifth exciting episode of the Security Round Table. Our special guest (and now newest member) is Dan York from: Blue Box: The VoIP Security Podcast. In this episode, we look at the general overview of VoIP technologies and the security risks – as well as the myths.

Dan is a true expert and instructor on this topic – and school was definitely in for the SRT team!

Joining in on this episode:

**Note – soon I you will only be able to get this podcast by subscribing to the SRT podcast ***

Security Catalyst 36 – SPECIAL REPORT: Did Two Factor Authentication Really Fail?

Michael Santarcangelo — Wed, 27 Sep 2006 23:32:23 +0000

Welcome back! Yeah, I know, that’s better said to me than by me. The complications of travel, life and podcasting have conspired against me, but not dimished my passion, the expansion of the blog or the re-creation of the catalyst community.

In this episode, I introduce a new segment: “sites to see” and start pointing out security and security 2.0 websites to use.

This weeks Site to See

Microsoft Security Advisories
http://www.microsoft.com/technet/security/advisory/default.mspx

You can learn why I think it’s worth checking out by listening to the podcast. If you have a suggestion for future sites to see (your own or something you think is valuable), send me your idea (and get credit) by email: securitycatalyst@gmail.com.
Special Report
Did Two Factor Really Fail?

The short answer is: no – listen to learn what could have been done differently and why you should care!

Special Offer
I am offering a substantial discount to the first few people who want to improve the way their company addresses compliance and security (while making themselves look like rockstars) as I am about to unveil Effective Assurance. Listen to the podcast for details – or send me an email at michael.assurance@baldsecurityexpert.com — I look forward to sharing my passion with you and helping you improve compliance through security without wasting another dollar!

**** 17 Days and the Catalyst Community is OPEN!! ****

SRT Episode 4 – Responsible Reporting of Breaches

Michael Santarcangelo — Sun, 17 Sep 2006 20:23:23 +0000

How many times have you wondered what you would do if you find out your company wasn’t protecting information as they promised? What if you were a consultant or contractor?

Is there a right way to report on privacy and security breaches?

Join the Security Round Table with Special Guest Randal Schwartz to discuss this important issue.

On this episode:

Note: we did reach some interesting conclusions and directions for future advancement. Continue the discussion at the Security Catalyst Community (currently open to trusted catalysts until October 15, 2006 when it becomes available to the entire community).

Security Catalyst – 35 – Introducting Security 2.0

Michael Santarcangelo — Tue, 29 Aug 2006 04:09:06 +0000

Recorded! From a hotel room in Phoenix (sure, it’s hot, but it’s a dry heat – try taking a tumble in your clothes dryer)… it’s another Security Catalyst Podcast (I know, about time!).

I’m actually excited to share something I’ve been quietly working on now for over a year – the evolution of security I have been calling Security 2.0. Wait! Look past the name and check out what I think the future for information security holds. I have started to collaborate with Ron Woerner on what this would entail, and we have submitted a proposal to speak at RSA 2007 in February – if selected, we hope that will be where the concepts really get grounded and introduced.

Until then, you can count on Ron and I to start to advance the concepts and the ideas covered in Security 2.0. Basically, security 2.0 comes down to three elements:

leveraging web 2.0 to improve the way we practice information security

taking the knowledge we have and securing web 2.0 offerings

the tools, skills, attitudes and experiences of a Security 2.0 professional

Basically, I believe it’s time to completely shift the way we practice information security. We have to change the focus, make it more convenient, more simple and more, well, secure. It’s not that simple – but in this podcast, I introduce the concepts in a condensed fashion. More details will emerge and evolve in the coming weeks and months.

I look forward to your ideas, insights, passions and excitement as we work together to celebrate the positives and truly blaze a new trail in the future of information security. By learning our history and studying other fields, we will advance!

If you’re new to Web 2.0, here are some links to get you started:

Start Here:

What Is Web 2.0

http://www.oreillynet.com/pub/a/oreilly/tim/news/2005/09/30/what-is-web-20.html

This is a good summary: http://www.squidoo.com/introtoweb20/

I found this useful, too: http://en.wikipedia.org/wiki/Web_2

As we prepare to relaunch the Security Catalyst Community, we’ll incorporate a section for Security 2.0 so we can work collaboratively, leveraging Web 2.0 tools (!) to evolve this concept.

Help spread the word by linking to the Security Catalyst and share these ideas and concepts with others!

Listen to the experts, um, discuss “NAC” (An SRT special edition!)

Michael Santarcangelo — Mon, 14 Aug 2006 13:59:02 +0000

Network Access Control, or NAC, is a hot and important topic these days. Recently, some of the experts in the industry starting a discussion via their blogs… Martin McKeay then suggested they take it to the Security Roundtable and talk it through.

Thanks to the efforts of the team, we can all be smarter when it comes to NAC. You can listen to the result on the SRT website, here: http://www.securityroundtable.com/ or I included the link in the feed. Martin claims he was an innocent bystander. I don’t understand the claim of innocence
We’re scheduled to record another SRT this week, this time looking at the actions and impact/fallout of the AOL blunder. We’ve also got several more topics sure to impact our thinking in the trenches lined up for the coming weeks…

Security Catlayst 34 – Interview with Greg and Terry from Always Known As (AKA)

Michael Santarcangelo — Thu, 10 Aug 2006 06:24:08 +0000

Welcome to Security Catalyst 34! I am excited to bring you an interview with a Web 2.0 company that has incorporated security and privacy into their solution from the very beginning… Always Known As (AKA). Join me as I discuss their efforts and talk security and the future of digital ID management with Greg and Terry.

I recorded this from a hotel room in Phoenix, Arizona – which is why it’s a bit later than expected. I have more podcasts recorded, lined up and ready to be edited and released and will work to get back on track.

I’ve also been busy planning to new security catalyst community, the trusted catalyst designation and a new way for us to learn and practice security that I hope to roll out this fall – we have a lot going on!

After you listen this week, let me know what you think of AKA and what questions you would like me to ask. If there is enough interest, I’ll work to resume our teleconferences/skypecasts (probably for the Trusted Catalysts) in September where we will all have the opportunity to speak with Terry and Greg about AKA directly!

My AKA: Michael

I look forward to your comments and your continued efforts. I have some exciting programs planned that I’ll be releasing in the coming months. Keep making a difference!!

Security Round Table – Episode 3 – Liability for Vulnerabilities and Responsible Reporting

Michael Santarcangelo — Fri, 21 Jul 2006 20:17:34 +0000

I am excited to present to you the SRT’s third episode. The goal of these podcasts is simple: bring together podcasters and occassional guests to discuss important security topics. This episode had some great (read: diverse) representation as we tackled the issue of who should be responsible for vulnerable code and “good practices” around notification, patching and the like.

This podcast went a bit longer than planned, and I suspect we could have kept talking all night long! I personally learned quite a bit and enjoyed the opportunity to explore some of these issues and hear different perspectives. I hope you enjoy it too!

Joining us on this effort was:
Martin McKeay (The Network Security Podcast)
Paul Asadorian (Pauldotcom Security Weekly)
Jamal Khan (Hdaar Security Radio)
Alan Shimmel (Still Secure, After All These Years)
Ron Woerner (Security Catalyst Contributor)

Ideas? Comments? Suggestions? securitycatalyst@gmail.com

Michael (The Security Catalyst)

Security Catalyst 33 – Insider Interviews – The FBI Innocent Images Program

Michael Santarcangelo — Tue, 18 Jul 2006 15:48:01 +0000

As a father, I know that protecting my children and keeping them safe as they grow and develop is important. In today’s world, that extends to the way that we and our children use the Internet, as well as teaching them about the predators that lurk in the shadows.

On this important episode of the Security Catalyst, we are joined by FBI Special Agent David Fallon and Police Officer Jonathan Lester – part of the FBI Innocent Images program. In addition to educating us about their efforts, they share simple tips and strategies that we should all be following to protect our children, as well as ways that we can get involved to help (without harming their efforts).

Here is the listing of resources mentioned on the podcast. I will continue to update and expand this page (especially with your help and suggestions): http://www.securitycatalyst.com/protect-children/

Based on this interview, I have started research and looking for some additional interviews to provide us with some insights on how to coach our children through this important process, the steps we need to take to protect our children and ourselves, the ways we can get involved. If you want to contribute, please send me an email.

Please consider sharing this program with others (tell them to check out http://www.securitycatalyst.com/2006/07/18/sc33/) and use the buttons on your right to subscribe so you don’t miss any future content.

Security Round Table – Episode 2 – What to do about stolen laptops and Privacy in the EU

Michael Santarcangelo — Sun, 25 Jun 2006 04:07:12 +0000

We recorded the second episode of the Security Roundtable last week – and it is now available for your listening pleasure! On this episode, I was joined by SRT founding member Martin McKeay of the Network Security Podcast and special guest Alan Shimel from the Still Secure podcast.

We had a really engaging conversation about the recent laptop thefts and explored what has to be done about it, as well as expressed some opinions about the current actions. We talk about technical and non-technical solutions to address these issues.

We then explored the differences between the US and the European Union in terms of data privacy, breaches and breach reporting. I would really enjoy learning your opinion and hope you send me some feedback (until the forums/community is restored) — securitycatalyst@gmail.com.

Keep making a difference!

Security Catalyst 32 – Three Steps to Reduce Laptop Thefts (and Protect Data)

Michael Santarcangelo — Sun, 18 Jun 2006 19:10:14 +0000

Happy Father’s Day!

In reflecting on the lessons I learned (and continue to learn!) from my father (thanks, Dad!), I was considering the recent data breaches we have witnessed as a result of laptop (and other) theft. The reactions have been predictable and focus on finger pointing, passing the blame and then looking for the magical silver bullet that will solve the problems.

I think the solutions don’t start with technology, but rather start by addressing personal responsibility and accountability. From that basis, we are able to make better decisions and provide strong foundations on which to build our solutions.

In this podcast, I share with you some of the lessons I have learned in how we can affect this change. I share with you my experience and look forward to your contributions in the catalyst community.

I also share some of the listener survey results; great stuff for me, perhaps not as exciting for you. Thanks to your help, reviews and subscriptions, I have a healthy sense of what you expect and pledge to continue to improve and provide good value to you. If you want to know what’s coming ahead or provide feedback, please check the forums. And you are always welcome to send me an email, but for the next few months, I’m going to focus on programming.

If you’d like to explore or challenge the concepts I introduced today, please contribute to this thread in the forums.

Security Catlayst 31 – Interview with Scott Barlow from Reflexion

Michael Santarcangelo — Sun, 11 Jun 2006 19:11:06 +0000

I’m passionate about security, but also in exploring new solutions to the problems we face. Lately I’ve been exploring the economics of spam, and looking into ways we can disrupt the economics of spam in an effort to reduce it. During our first Security Round Table podcast, we talked about spam, and I mentioned that I was interested in disposable email addresses – and asked for links to companies that could do it.

A few days later, I came across Reflexion, a company with a different approach to reducing spam, since they use what they call “non-disposable” email addresses. I called and shared some good technical discussions, and then decided to interview Scott Barlow about their solution.

Now this marks the first time I have interviewed a vendor about their solution. I took an approach of asking the questions I would ask them if I were going to consider them for my company or on behalf of a client. I hope you find this useful, and if so, I will look for other noteworthy solutions to share with you.

Either way, let me know – and ask more questions in our forum in this thread (click on the link).

In the podcast, Scott mentions a link to a diagram, here is the diagram.

Also, here are some of the recent threads on the forums that I would enjoy your feedback on:

Certs, Degrees, And Stuff, The Professionalizing of the IT Industry

Security Blogs And Forums

What Are The First 5 Actions, Security Catalyst Case Study – Baselines

Wireless Security: Protecting Your Company (Westchester County, NY)

Promo: The Mighty Seek Podcast

Security Catalyst 30 (Insider Interviews) Botnets, part II with Jim Lippard

Michael Santarcangelo — Sat, 03 Jun 2006 20:15:17 +0000

Join us for Episode 30; we conclude our interview with Jim Lippard and discuss what is being done to combat botnets, as well as what we can or should be doing.

Jim has joined the forums and has been answering questions in the Episode 29&30 thread. Please join in and ask your questions, share your ideas or help explore how we can make a difference.

Information about Trusted Catalysts can be found here.

It’s not too late to contribute to the Catalyst Survey and suggest how I can improve. Click here to take the survey.

Security Round Table – Episode 1 – Email Security

Michael Santarcangelo — Thu, 25 May 2006 21:17:45 +0000

Listen in as Martin McKeay (Network Security), Dan Kuykendal (Mighty Seek), Larry Pesce (Pauldotcom Security) and Michael Santarcangelo (The Security Catalyst) discuss email security during the first Security Round Table. We recorded the podcast from a conference bridge, so the quality is about what you would expect from the broadcast radio.

This is our first effort – and I learned some ideas that I wrote down, and hope you do, too! Please send us feedback and let us know what other topics you would like for us to cover.

Check out more at the Security Round Table.

Please send me feedback and suggestions to securitycatalyst@gmail.com

Discuss this episode with others here in The Security Catalyst Forums

Security Catalyst 29 (Insider Interviews) – Botnets with Jim Lippard, Part I

Michael Santarcangelo — Tue, 23 May 2006 18:49:53 +0000

We’ve all heard the term “botnet — and have even seen the recent arrests,successful trials and sentencing of botnet “herders.” So what exactly are botnets, how do they affect us and why should we care?

Jim Lippard joins us to share his insights on how botnets work, and helps us understand why they are continuing to grow at an alarming rate. Listen to this first of two interviews with Jim to understand the basics of botnets and get ready to learn how we can combat them on the next episode.

Please take 5 minutes to complete the Security Catalyst Listener Survey and help improve the program.

Discuss Security Catalyst 29 and Botnets here.

Ideas and suggestions about Trusted Catalysts Here.

Security Catalyst 28 – The Practice of Information Security | Influence the Future of the Catalyst

Michael Santarcangelo — Tue, 16 May 2006 20:56:55 +0000

After a brief and unintended break, I’m back. Actually the beginning of this episode is a bit of an explanation of what the last few weeks were like (basically, life, business and travel all collided). So we’re back – and starting around the 7 minute mark, I explain some insights I have gained on information security and what we need to do to shift the culture of security.

In this episode, I also ask for your comments and insights on how to better focus and improve the security catalyst. If you could take a few minutes to respond to this survey (PLEASE TAKE A MINUTE FOR TO COMPLETE THE SURVEY) or share some ideas with me at securitycatalyst@gmail.com, I’d appreciate learning how I can better serve you.

Look for links and episode information in the forums here: Discuss Security Catalyst 28

Learn about the Security Roundtable here: The Security Roundtable

Security Catalyst 27 (Wireless Law!, Compliance Advice, Your top 5?)

Michael Santarcangelo — Thu, 27 Apr 2006 15:50:01 +0000

NOTE: due to an unexpected Feedburner error, we turned off the redirect and have begun the process of migrating away. This should not affect you if you are using iTunes – but please check your subscriptions. Thanks!

Sorry if you get this twice.

===Begin Program ===

Welcome to episode 27 of the Security Catalyst Podcast! In this episode, we talk about the new wireless security law enacted by my neighbors in Westchester County, NY; I offer some advice and guidance on compliance (based on my experience) and then set up a case study to help us determine the steps we need to take when protecting our organizations.

The wireless law is an interesting one, and I look forward to leveraging our growing catalyst community to help provide the guidance necessary for this effort to be successful. In that same vein, we start with our security makeover series next week, and will be using the next 10 weeks to examine how to acheive compliance through security. This is a series that will benefit us all – and you will have a chance to be involved!

Based on a conversation I had yesterday, I wanted to pose a situation and then collectively determine the immediate actions we would take. The end result of this effort (over the next few months) will be a series of comprehensive (and validated!) baselines that we can use to shore up our efforts. More importantly, done right, other businesses and people new to security can learn from our experience, too!

I will post additional information and links in the forums -> and we can let the discussions begin!

Discuss Security Catalyst 27 Here
Discuss The First 5 Security Actions Here

Thanks for listening. Please tell a friend about our efforts and encourage them to subscribe!

Security Catalyst 26 – Insider Interviews – Randal Schwartz

Michael Santarcangelo — Fri, 21 Apr 2006 15:25:06 +0000

In late July 1995, a trial jury convicted Randal L. Schwartz of three felony counts under Oregon’s Computer Crime Law (learn more here). On this episode, we are joined by the legendary Randal Schwartz to discuss what happened to him, how you can prevent it from happening to you, and what we can all do about it in the future.

We will invite Randal back again in the future to talk about perl and application security – but I hope that you are able to enjoy this interview and learn how to protect yourself. The focus is not on the company Randal was working with, but with how broad laws can hurt – and the protections we should all have in place.

Randal has joined our forums to take part in any discussion about how to deal with laws like this, and how we can, as a community, make a difference. I look forward to your insights and experiences: Click here to go to the forums.

In case you missed the teleseminar on Tuesday, the information and discussion has started: Click Here to talk about “Free Security.”

I’d like to know what sites you use for “best practices.” Share your insights here: Security Best Practices

Thanks for listening. If you liked the show, tell a friend!

Security Catalyst 25 – Insider Interviews – Podslurping with Abe Usher

Michael Santarcangelo — Thu, 13 Apr 2006 16:15:23 +0000

When I first read the term podslurping, many things came to mind. My second reaction was along the lines of “we’ve known about the risk from USB and portable devices for a while, so what’s new?” Then I finally got around to reading the article and learning from Abe Usher why I needed a different mindset.

It turns out that advancements in USB technology, combined with the improvement of the devices that use USB and the ever-growing storage capacity, in fact, pose a significant potential threat. We focus a lot of time and energy right now on perimeter protections and the like – and yet freely recognize insider threats are more damaging.

Abe Usher got the word out, and now he joins Security Catalyst to help change the way we think about end point security. Listen now to learn how podslurping can affect you – and what you can do about it today.

Learn more about podslurping from Abe Usher at his Sharp Ideas website.

Continue the discussion and learn more about the technologies mentioned in the podcast in the Security Catalyst Forums (click here).

The “Hot Topic” of the week is Certs, Degrees, And Stuff, The Professionalizing of the IT Industry — join in the conversation!
Join us next week for an insightful interview with Randal Schwartz!!

Security Catalyst 24 – (Insider Interviews) Wireless Security Basics with Red Wagner

Michael Santarcangelo — Fri, 07 Apr 2006 17:26:50 +0000

On this episode of the Security Catalyst, we are joined by Red Wagner who shares his research on wireless security basics, and the critical steps home and business users need to take to protect themselves. Listen in to learn the 5 steps you can take today to ensure you are more protected at home!

I have been working on a Wireless Security “Basics” eGuide that Red has agreed to help with – and we should have that published by next week for your review and use.

Talk about wireless security in the forums here: SC24 in the Catalyst Forums
Red’s posted question in the forums is here, please answer it if you can: Red Wagner’s Question – Gmail Chat Security/privacy, Opt-out chat logging

Thanks for listening. If you liked the program, please tell a friend. If not, please tell me: securitycatalyst@gmail.com

Security Catalyst 23 – Greylisting (and why you should be using it)

Michael Santarcangelo — Wed, 05 Apr 2006 21:06:57 +0000

Join me as we start our look at open source email protections by looking at Greylisting. Greylisting is a simple, but highly effective, measure to help reduce spam. What is most promising about greylisting is that it actually provides a great economic disincentive to spammers at a low economic cost for us. OUTSTANDING!

So listen in and learn how you can use greylisting to your benefit and join me in providing cost effective ways to reduce spam.

If you would like to join the Security Catalyst Research effort to implement greylisting, please go to the forums here: Forum Topic (This does require FREE registration)
If you would like to learn more about greylisting, click here to read the whitepaper written by Evan Harris.

The forum question of the week, needing YOUR answer is here: Looking To Get Certified

Thanks for listening! If you liked the podcast, please tell a friend. If not, or you have suggestions for how to improve, please tell me: securitycatalyst@gmail.com.

Security Catalyst 22 (Insider Interviews) – How to protect yourself from Identity Theft with John Sileo

Michael Santarcangelo — Fri, 31 Mar 2006 04:15:42 +0000

Identity Theft is a topic covered nearly every day in the newspapers, magazines and television programs we watch. It continues to be the top complaint filed with the FTC each year — and as this problem continues to grow, we suddenly have a lot of “experts” handing out misleading and wrong information!! Do you know what to do to protect yourself? Are you sure?
For our Security Insider Interview this week, we are joined by Identity Theft expert and author of Stolen Lives, John Sileo. John and I met this summer at the National Speakers Association, and I was skeptical at first about his expertise (since like I already wrote, there are a lot of people who claim to be experts). I’m happy to tell you that John is the real deal – and you’ll learn why and experience his passion in our interview.

This is a show you will want to listen to again and share with your friends. IF YOU DO NOTHING ELSE, PLEASE TAKE SOME ACTION TO PROTECT YOURSELF TODAY. John offers sound advice; if you follow his suggestions, you just might prevent your own personal disaster.

***

Continue the conversation in the FREE security catalyst forums by clicking here

***

To learn how to “think like a spy,” use this link to order the Stolen Lives Book.

You can reach John Sileo by visiting his website at: http://www.thinklikeaspy.com/

Please take a moment to rate the show in Yahoo! Podcasts with the links to the right. If you liked the show, please tell a friend. If not, please tell me: securitycatalyst@gmail.com.

Security Catalyst 20 – Email Security with Matt Yoder

Michael Santarcangelo — Mon, 13 Mar 2006 04:22:36 +0000

Back from Vegas, Matt Yoder shares his insights on email security. This candid interview includes some basic information, as well as the considerations every company should be taking into account when dealing with compliance and email security.

Security Catalyst 19 – The Secrets of Risk Management (With Ron Woerner)

Michael Santarcangelo — Wed, 22 Feb 2006 06:29:37 +0000

I had the opportunity yesterday to speak with Ron Woerner about Risk Management… and I was so impressed and excited about the tips and advice that he shared that I decided to get this out to you right away.

Ron Woerner is an expert in information security and has spearheaded an effort to develop an effective risk management program for a large company. He agreed to speak with me about his experiences – and provides great ideas, insights and information that we can all use!

I want to thank Ron for speaking with us and for sending along some resources. I’ve actually invited Ron to present on “FREE SECURITY” in an upcoming free teleseminar for our newsletter subscribers. Subscribe today so you don’t miss the resources he is going to share.

If you enjoyed this interview, please tell a friend, colleague or other security professional — this is an important topic, and the 25 minutes Ron shared will help anyone save a lot of time and money!

Risk Management Resources

ASIS International, General Security Risk Assessment Guideline, 2003

BITS, Kalculator: Key Risk Measurement Tool for Information Security Operational Risks, July 2004

Berinato, Scott, “Enterprise Risk Management,” CIO Magazine, November 1, 2004, pp. 46-58

Bernstein, Peter L., Against the Gods: The Remarkable Story of Risk, John Wiley & Sons, 1998.

COSO (Committee of Sponsoring Organizations of the Treadway Commission), Enterprise Risk Management – Integrated Framework, September 2004

IRM AIRMIC & ALARM, A Risk Management Standard, 2002

Microsoft Corporation, The Security Risk Management Guide, 2004

NIST (National Institute of Standards and Technology), Special Publication 800-30: Risk Management Guide for Information Technology Systems, October 2001.

NIST (National Institute of Standards and Technology), Special Publication 800-37: Guide for Security Certification and Accreditation of Federal Information Systems, May 2004.

NIST (National Institute of Standards and Technology), Special Publication 800-64: Security Considerations in the Information System Development Life Cycle, October 2003.

Risk Management FAQ, Carnegie-Mellon Software Engineering Institute

Security Catalyst 18 (In the Trenches Interview with FBI Special Agent Jim Beane)

Michael Santarcangelo — Fri, 17 Feb 2006 07:03:37 +0000

I am pleased to offer you Security Catalyst 18, an “In the trenches” edition that focuses on Cyber and Homeland Security. The current belief is that 85% or more of our critical infrastructure that needs to be protected is owned and operated by the private sector. So how do we effectively share information with the government and what should we be doing to protect ourselves? This show is geared for anyone interested in Homeland Security – especially if you want to make a difference.

One program available to US citizens and companies is Infragard – the joint partnership between the FBI and corporations to foster that cooperation. I recently was able to interview Special Agent Jim Beane, from the Albany, NY Division about his experience in the FBI as it related to cybercrime, homeland security and InfraGard.

Special Agent Beane candidly shares some insights about the value of sharing information, as well as dispells some myths and provides important information on how we can better help in the effort to secure cyberspace and protect our homeland.

If you have questions about membership in InfraGard or cybercrime that were not addressed, please send me an email to securitycatalyst@gmail.com and I will work to get them answered for you.

Links and Information

Please remember to rate this podcast on iTunes and Yahoo! Thanks!!

Here are some notes and links from this episode

InfraGard – Guarding the Nation’s Infrastructure

To Join InfraGard

To report an cyber-related complaint — Internet Crime Complaint Center

Security Catalyst 17 (Home User Security – Email and Browsers)

Michael Santarcangelo — Mon, 13 Feb 2006 20:20:39 +0000

This is our second special episode focusing on Home User security issues. Today we focus on email clients and browsers – and the basic steps you need to take to protect yourself. Michael is joined by special guest Bill Matherly, Jr. – and they describe the actions they take to protect themselves, and their friends and family.

Listen to the show to see which programs and configurations we recomend to our family and friends. As our new friends, you’ll want to make use of our links and information to keep yourself protected!

Links and Information

Please remember to rate this podcast on iTunes and Yahoo! Thanks!!

Here are some notes and links from the show today:

Firefox

Thunderbird

Security Catalyst Consumer/Home User Security Resources

Security Catalyst 15 (Cell Phone Records, Anonym.OS, Biometrics at School)

Michael Santarcangelo — Sat, 28 Jan 2006 22:22:15 +0000

After a hectic travel week, we present Security Catalyst 15. Join Michael as he examines the issues around cell phone numbers and records being offered for sale, a newly announced anonym.OS operating system and the how a NJ school is using biometrics — and 4 questions you need to ask if your organization is thinking about using biometrics.

Here are some notes and links from the show today:

The Official FTC Advisory on Cell Phone Telephone Numbers

Tor: An anonymous Internet communication system

Anonym.OS LiveCD

eyemetric identity systems

The International Biometric Industry Association (IBIA)

How Iris Recognition Works

Security Catalyst 14 (Rundown with Matt Yoder #1)

Michael Santarcangelo — Mon, 23 Jan 2006 03:06:25 +0000

Join us as Matt Yoder, formerly just a text contributor to the blog, finally puts his money where his mouth is (or vice versa,) and joins Michael in co-hosting the Security Catalyst Rundown #1!

On this episode, we dive into the industry lingo and what is really meant by “rootkit, trojan, and backdoor,” and how those terms relate to some of the topics in the news lately. We also discuss patch management for a home user as it compares to the corporate world, and analyze some of the difficulties both sides get to contend with. We then wrap up with an introductory look at Risk Assessment, and are reminded that NIST has recently updated their excellent guidance document, SP800-40 with a second version (November 2005).

The links from the show are here….
Creating a Patch and Vulnerability Management Program (NIST SP 800-40V2)

We developed this weekend show based on feedback and a desire to introduce some new ideas into the security dialogue. Send feedback, ideas, suggestions and questions to securitycatalyst@gmail.com. Thanks for listening!

The following track from the podsafe music collection of podshow was used during the introduction of SC14.
BAJA TAXI

Please remember to rate this podcast on iTunes and Yahoo! Thanks!!

Security Catalyst 13 (Home User Security Basics)

Michael Santarcangelo — Fri, 20 Jan 2006 14:17:35 +0000

Join us as Michael interviews Bill, a former “black hat” hacker (reformed) about the 3 basic steps we advise our friends and familes to take when it comes to protecting their home computers. While there are many things you can do to protect yourself and your family when connecting a computer to the Internet, we cover the three things you absolutely must do!

Join us as we discuss why these steps are important and gain the knowledge you need to be a bit safer!

The links from the show are here….
We are in the process of building a collection of consumer/home computer security links. Click here to check the current list and get information about updating your system, firewalls, anti-virus, anti-spyware and some good general advice.

The following track from the podsafe music collection of podshow was used during the introduction of SC13.
BAJA TAXI

Please remember to rate this podcast on iTunes and Yahoo! Thanks!!

Security Catalyst 12 (Symantec Rootkit, More Microsoft, Military Accounts)

Michael Santarcangelo — Sun, 15 Jan 2006 18:27:48 +0000

The recent Symantec vulnerability that affects 63 (!) of it’s products was announced in the end of December, but flew under the radar. They were back in the news this week with discussions about a rootkit — and we examine both issues and help you take steps to be protected. We also briefly look at the new security concerns for exchange/outlook and then focus on talking about dormant user accounts and the large security risk they pose. We talk specifically about key actions you can take to reduce your risk.

The following track from the podsafe music collection of podshow was used during the introduction of SC12.
BAJA TAXI

Security Catalyst 11 – (WMF Patched, H&R Block Blunder, DHS Takes a Stand)

Michael Santarcangelo — Sat, 07 Jan 2006 17:50:42 +0000

Here is a list of things to do:
* subscribe with the RSS 2.0 feed(s) to your right (or below for yahoo and iTunes)
* Call the listener feedback line: 206-339-9361
* If you liked the show, tell a friend; if you didn’t, tell me!

Subscribe in iTunes using this link (Click Here Now)

Subscribe or RATE THE SHOW in Yahoo Here. Please take the time to rate the show for the series as well as the specific episode.

==>Download or listen to Security Catalyst #11 here (27 minutes long) < ==

On This Episode
The Windows WMF “Zero-Day Exploit” gets patched
Well, the patch is out – several of them. We talk about the MS patch, as well as briefly touch on the discussion around third party patches, patch management and then focus on the larger issue of defense in depth. Are you practicing good defense in depth?

Microsoft Announcement and Information

H&R Block Blunder
In reality, this isn’t probably going to be a big deal – but I was amazed as we ended the year to find yet another company has been required to notify customers that they may have had a compromise of personally identifiable information. In this case, the social security number (SSN) of the recipient of TaxCut software was included in the tracking number. We discuss corporate accountability and how to help protect your company from these mistakes.

USA Today Story

DHS takes a risk assessment approach
Not enough attention has been positively applied to the common sense approach DHS is applying with homeland security money. Rather than dole out the money in a political fashion, they have decided to take a “risk-based” approach. While the specific details are only coming to light now, this is an excellent step that sets the example – and may give you the opportunity to take the same approach with your business or home network.

DHS Press Release

The following track from the podsafe music collection of podshow was used during the introduction of SC11.
BAJA TAXI

Please remember to rate this podcast on iTunes and Yahoo! Thanks!!

WMF Exploit – letter to your users

Michael Santarcangelo — Mon, 02 Jan 2006 13:35:44 +0000

Here is the message from Matt. Hopefully this saves you some time or otherwise helps out! Thanks, Matt, for taking the time to share!

====== Begin Message ========

A vulnerability with WMF (Windows Metafile) files was discovered on December 27, 2005. There are no patches for at this time to fix the problem (zero day exploit). Currently there are many websites in the wild that use the weakness in WMA to install Spyware on a user’s computer without the user‘s permission. Even if you are using Firefox on a fully patched Windows XP SP2 system you are vulnerable.

A WMF file is an image file that supports both Vector and Bitmapped formats. When a program opens a WMF multiple GDI calls are made to “draw” the image on the screen. In older 16 bit versions of Windows there was a GDI call called SETABORTPROC that was used to execute code if there were any problems drawing the image. This call still exists in current versions of Windows.

When you go to a website that takes advantage of the vulnerability it will send a corrupted WMF file to you. When your computer draws the image it will fail, at that point it will execute the code from the SETABORTPROC section. The code that executes can do pretty much anything that the currently logged on user can do. (Install Spyware, virus, become a bot in an iRC chat etc..)

Alternatively the corrupt WMF file can cause buffer overflow errors as well using different GDI calls.

There really isn’t a fix for this. There are some things you can do to help your self.

* One is get ride of Google Desktop, it will launch (or relaunch) a virus or this vulnerability when it indexes a file.
* Unregistered the Windows Picture and Fax Viewer by click Start – Run and typing “regsvr32 -u %windir%\system32\shimgvw.dll”
* Enable DEP (Data Execution Prevention)
* Watch where you are going on the web…. (you know what I mean)
* Block Windows Metafile, although this can be tough since it can come in as something other then WMF.

Happy New Year

Matt Hull

====== end message =====

Security Catalyst #10 – (Windows WMF Exploit, SONY Settles, Year in Review)

Michael Santarcangelo — Fri, 30 Dec 2005 23:43:56 +0000

Here is a list of things to do:
* subscribe with the RSS 2.0 feed(s) to your right
* Call the listener feedback line: 206-339-9361
* If you liked the show, tell a friend; if you didn’t, tell me!

Subscribe in iTunes using this link (Click Here Now)

Subscribe or RATE THE SHOW in Yahoo Here. Please take the time to rate the show for the series as well as the specific episode.

Take the 2006 Security Spending Survey RIGHT NOW. DO IT.

==>Download or listen to Security Catalyst #10 here (28 minutes long) < ==

On This Episode
The Windows WMF “Zero-Day Exploit”
We quickly explain the concepts behind “zero-day” attacks and exploits and the describe the current problem, as well as immediate steps you should take to protect yourself and your organization.

Here are some links with detailed information you can use to help protect yourself:
F-Secure Weblog
Workaround, Protections Emerge for WMF Exploit
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution – MICROSOFT
US-CERT: Vulnerability Note VU#181038

The Proposed SONY-BMG Settlement
The proposed settlement for CONSUMERS is interesting – and we take a look at the impact this may have to the long-term health of SONY-BMG, as well as what it may mean as a trend for corporate accountability.

2005 in Review – and what to do with this knowledge!
Rather than just recap some of the top trends, we go a bit deeper and look at what it means for those of us in the trenches – and what we might be doing about it next year. Even though some of the trends are negative, the results I found to be quite promising — especially as we look forward to an exciting and productive 2006.

Have a safe and Happy New Year!